Risk Implementation Approach Flashcards by John Faber

Risk Record & Risk Framework - lifecycle and role to create

active - inactive

Risk manager or above

How well did you know this?

Not at all

Perfectly

Risk Lifecycle

Draft
Assess
Respond
Review
Monitor
Retired

How well did you know this?

Not at all

Perfectly

Who can create a risk

Risk User

How well did you know this?

Not at all

Perfectly

Who performs risk assessment

Risk Owner

How well did you know this?

Not at all

Perfectly

Who can move risk into monitor

Risk Manager

How well did you know this?

Not at all

Perfectly

Who can retire a risk

Risk Manager

How well did you know this?

Not at all

Perfectly

Risk Response Lifecycle

Draft
Work in Progress
Review
Closed

if it is an “accepted” risk (not mitigate, avoid, transfer) “awaiting approval” state is included after WiP

How well did you know this?

Not at all

Perfectly

Who/How are Risk Responses generated

Automatically when risk is in “respond” state

or by Risk User

How well did you know this?

Not at all

Perfectly

Who can be assigned Risk Response

Risk User

How well did you know this?

Not at all

Perfectly

Who can assign Risk Response

Risk Manager

How well did you know this?

Not at all

Perfectly

Who can close Risk Response

Assigned Risk User

or grc_manager

How well did you know this?

Not at all

Perfectly

Primary Risk Relationship

Risk Framework Risk Statement Risk

RF–>RS =m2m, RS–>RF=0to1, RS–>Risk=m2m, Risk–>RS= NotSpecified?(P.188

How well did you know this?

Not at all

Perfectly

**Recommend studying page 189

**recommend studying page 189

How well did you know this?

Not at all

Perfectly

Indicator template - name and scope

sn_grc_indicator_template

GRC: Profiles

How well did you know this?

Not at all

Perfectly

Indicator - name and scope

sn_grc_indicator

GRC: Profiles

How well did you know this?

Not at all

Perfectly

Risk Statement - name and scope

sn_risk_definition

GRC: Risk

How well did you know this?

Not at all

Perfectly

Risk - name

sn_risk_risk

GRC: Risk

How well did you know this?

Not at all

Perfectly

Entity Type - name and scope

sn_grc_profile_type

GRC: Profiles

How well did you know this?

Not at all

Perfectly

Entity - name and scope

sn_grc_profile

GRC: Profile

How well did you know this?

Not at all

Perfectly

Issue - name and scope

sn_grc_issue

GRC: Profiles

How well did you know this?

Not at all

Perfectly

Risk Assessment - name an scope

asmt_metric_type

GRC: Risk

How well did you know this?

Not at all

Perfectly

Risk Response Task - name and scope

sn_risk_response_task

GRC: Risk

How well did you know this?

Not at all

Perfectly

Controls - name and scope

sn_compliance_control

GRC: Policy and Compliance

Risk Event - name and scope

sn_risk_advanced_event

GRC: Risk

Risk to Control table name

sn_risk_m2m_risk_control

Entity Type to Risk Statement table name

sn_risk_m2m_risk_definition_policy_statement

Risk Framework to Entity Type

sn_risk_m2m_framework_profile_type

Modify the calculations of multiple risks on an entity

RiskUtils

Add additional calculations to risks

RiskALECalculator

Change the relationship behavior between a Control and a Risk

Mitigation Controls

Change the states and behaviors of risk mitigation

RiskResponse

Modify how Risks are generated and associated to entitties

RiskGeneratorStrategy

Adjust the colors and display settings when creating a risk heat map

RiskHeatMap

Risk Assessment Methods

Quantitative (SLE & ARO) (default) | Qualitative (Impact & Likelihood)

4 components of a risk score

[SLE/Impact] [ARO/Likelihood] ALE (Annualized Loss Expectancy) Score

Scoring Types

Inherent Calculated Residual

SLE * ARO = Inherent ($18M*60%=) Residual ($6M*40%=)

= ALE Inherent (=$10.8M) Residual (=$2.4M)

Regardless of Quant vs. Qual. ALE will....

always be the same

Where to change risk criteria

Risk Criteria Matrix | Risk > Administration > Risk Criteria

``` Impact: 1 - very low 2 - low 3 - moderate 4 - high 5 - very high (what are default currency values) ```

``` $1M $5M $10M $20M $25M ```

``` Likelihood: 1 - extremely unlikely 2 - unlikely 3 - neutral 4 - likely 5 - extremely likely (what are default percentages) ```

``` 20% 40% 60% 80% 100% ```

``` Score: 1 - very low 2 - low 3 - moderate 4 - high 5 - very high (what are currency values) ```

``` $1M $5M $10M $20M $25M ```

What is Control Failure Facture

impact of control failures on calculated score | %=(weight of non-compliant controls)/(weight of all controls)

Indicator Failure Factor

Impact of risk indicator failures on the calculated score of risks %=(failed risk indicators)/(all risk indicators)

Calculated risk factor

represents the average impact factor that is used to compute calculated score or risk %(CFF+IFF)/2 (if IFF is null, CRF will not calculate)

Calculated ALE

residual ALE + [(inherent ALE - residual ALE)*(CRF/100)]

Biggest benefit of Advanced Risk

rollup/hierarchy | reporting

Different Risk Assessment with Advanced Risk

Operational Assessment Application Assessment Project Assessment

3 assessment types that can be included in Risk Assessment Methodology (RAM)

Inherent Control Effectiveness Residual Risk

Service Portal Customization

Separate portal for risk and compliance add approvals add task management

import options

import into risk framework & statement tables

Risk Framework Form customizations

``` Add fields - importing owner/owning group reviewers approvers valid from/valid to ```

Risk Statement form customizations

``` Add fields - imported order classification (need choices) type (need choices) active flag ```

Risk form customizations

add fields - created manually type status (not assessed, acceptable warning, exceeds tolerance)

Risk Response Tasks form customization

Add fields - work notes list, watch list assignment group due date

Tables extending rom Risk Response Tasks

Risk Acceptance Task Risk Avoidance Task Risk Mitigation Task Risk Transfer Task